4 ms·

my company seems to be going on a encrypt everything spree. I am not sure how GDPR requires encryption. Can you be GDPR complaint ( in theory) with zero encryp

my company seems to be going on a encrypt everything spree. I am not sure how GDPR requires encryption. Can you be GDPR complaint ( in theory) with zero encryption?

grabeh 9y ago
The GDPR, as with existing EU data protection law requires technical & organisational measures in place to protect data. The GDPR specifically calls out (Article 32 if you're interested) encryption as one measure that entities should consider in determining whether their technical & organisational measures are fit for purpose. Generally speaking, encryption is an obvious choice when it comes to measures designed to protect user data.
Radim 9y ago
Of course—if you don't store personal data (trivially). In fact, encryption (security) is mostly orthogonal to how you track and handle personal and sensitive data (privacy protection). You could encrypt everything and still be wildly GDPR non-compliant, if the encrypted information you're storing lacks clear purpose and explicit consent.
- wglb 9y ago
  To further emphasize your point You could encrypt everything and still be wildly GDPR non-compliant, we need to be able to respond to a request by each and every individual user to delete the information that they no longer wish us to carry.
  - gnud 9y ago
    ... unless you actually need that data (billing for past services, keeping records as required by law, etc).
- bostik 9y ago
  Indeed. We store data encrypted because it A) leaves no room for misunderstanding with different regulators or their respective auditors, and B) provides a computationally infeasible barrier against accidental personal information disclosure even if the storage system was improperly decommissioned Point B in particular can be explained to auditors without problems. They understand both the intent and the technical measures put in place. But how we store data is only tangentially relevant to how we handle data. Let alone what we need to collect in the first place. (The KYC/AML/SOW requirements in gambling are quite demanding; they impose significant data collection and retention needs.)

my company seems to be going on a encrypt everything spree. I am not sure how GDPR requires encryption. Can you be GDPR complaint ( in theory) with zero encryption?

grabeh 9y ago

The GDPR, as with existing EU data protection law requires technical & organisational measures in place to protect data. The GDPR specifically calls out (Article 32 if you're interested) encryption as one measure that entities should consider in determining whether their technical & organisational measures are fit for purpose. Generally speaking, encryption is an obvious choice when it comes to measures designed to protect user data.

Radim 9y ago

Of course—if you don't store personal data (trivially). In fact, encryption (security) is mostly orthogonal to how you track and handle personal and sensitive data (privacy protection). You could encrypt everything and still be wildly GDPR non-compliant, if the encrypted information you're storing lacks clear purpose and explicit consent.

wglb 9y ago
To further emphasize your point You could encrypt everything and still be wildly GDPR non-compliant, we need to be able to respond to a request by each and every individual user to delete the information that they no longer wish us to carry.
- gnud 9y ago
  ... unless you actually need that data (billing for past services, keeping records as required by law, etc).
bostik 9y ago
Indeed. We store data encrypted because it A) leaves no room for misunderstanding with different regulators or their respective auditors, and B) provides a computationally infeasible barrier against accidental personal information disclosure even if the storage system was improperly decommissioned Point B in particular can be explained to auditors without problems. They understand both the intent and the technical measures put in place. But how we store data is only tangentially relevant to how we handle data. Let alone what we need to collect in the first place. (The KYC/AML/SOW requirements in gambling are quite demanding; they impose significant data collection and retention needs.)